isrstealer | ba8ce58efa9742a2f5639697449cf1b3394c40bc74dee3235fa81865a8dae2e0

General

Target

ba8ce58efa9742a2f5639697449cf1b3394c40bc74dee3235fa81865a8dae2e0N.exe
Size

962KB
Sample

250201-vwv44aslbx
MD5

2626b7755d40d743f55c7580a1beb8b0
SHA1

e3771299ec9da3c6ed2ee23ebf509e08fbd1237f
SHA256

ba8ce58efa9742a2f5639697449cf1b3394c40bc74dee3235fa81865a8dae2e0
SHA512

1a5df2f2c182601716575f12ea0bc6a677500e9c8a962b442bd1d31c35a6a287c790061b2071ffac31ebf94a138b0e3d6c8ef53b0cd424faa5a7e63259732e05
SSDEEP

24576:Jt24wfvf7a8DPw67oc1xuzoVF5r5QAwFv0XcI:1ef7aD6Ffuw7B2fI

Score

10^/10

Malware Config

Targets

- Target
  
  ba8ce58efa9742a2f5639697449cf1b3394c40bc74dee3235fa81865a8dae2e0N.exe
- Size
  
  962KB
- MD5
  
  2626b7755d40d743f55c7580a1beb8b0
- SHA1
  
  e3771299ec9da3c6ed2ee23ebf509e08fbd1237f
- SHA256
  
  ba8ce58efa9742a2f5639697449cf1b3394c40bc74dee3235fa81865a8dae2e0
- SHA512
  
  1a5df2f2c182601716575f12ea0bc6a677500e9c8a962b442bd1d31c35a6a287c790061b2071ffac31ebf94a138b0e3d6c8ef53b0cd424faa5a7e63259732e05
- SSDEEP
  
  24576:Jt24wfvf7a8DPw67oc1xuzoVF5r5QAwFv0XcI:1ef7aD6Ffuw7B2fI
Score

10^/10

isrstealer collection defense_evasion discovery persistence stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Isrstealer family
  isrstealer
- Modifies visiblity of hidden/system files in Explorer
  defense_evasion
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2